faizbawa/mcp-remote-ssh

MCP server giving AI agents full SSH access -- persistent sessions, structured command output, SFTP file transfer, port forwarding, session transcript recording, and **secret-safe environment variable injection with automatic output redaction**.
Why this exists
Every other SSH MCP server is missing something: no password auth, no persistent sessions, no SFTP, no port forwarding, or no structured exit codes. This one has all of them -- plus the only MCP-level secret management that prevents AI agents from ever seeing your credentials.
Secret-Safe Environment Variables
**The problem:** When an AI agent needs to use API tokens, passwords, or keys on a remote server, the standard approach exposes secrets in the LLM's context window. The agent either reads the secret file (now it's in the conversation) or runs echo $TOKEN and sees the value in the output.
**The solution:** ssh_load_env_file reads secrets from a local file on your machine, injects them into the remote SSH session, and registers them for **automatic output redaction**. The AI agent can use the variables freely -- every tool response is scrubbed before it reaches the LLM.
How it works
1. **Local file read** -- the env file lives on your machine, never on the remote host
2. **Shell injection via builtins** -- uses read -r VAR remote) |
| ssh_list_forwards | List active tunnels |
| ssh_close_forward | Close a tunnel |
Quick start
Design
Built on **Paramiko** (SSH) + **FastMCP** (MCP protocol).
- ssh_execute uses exec_command() for clean structured output with real exit codes
- When secrets are loaded, ssh_execute feeds exports via stdin to a bash wrapper, then execs the actual command -- secrets never appear in the process tree
- ssh_shell_* uses invoke_shell() for persistent interactive sessions
- All blocking Paramiko calls run in run_in_executor to stay async
- Shell keeps a 500KB rolling buffer for shell_read` polling